| शीर्षक | FedML-AI FedML <= 0.8.9 Remote Code Execution |
|---|
| विवरण | Fedml is vulnerable to Remote Code Execution (RCE) due to unsafe deserialization in its gRPC communication manager. The application's gRPC server is exposed to all network interfaces (x.x.x.x) via an insecure port without requiring authentication. Network messages received through the sendMessage() RPC are passed directly to pickle.loads(). This allows an unauthenticated remote attacker to send a maliciously crafted Python pickle payload, which upon deserialization executes arbitrary code on the affected federated learning node.
|
|---|
| स्रोत | ⚠️ https://github.com/AnalogyC0de/public_exp/issues/26 |
|---|
| उपयोगकर्ता | Ana10gy (UID 93358) |
|---|
| सबमिशन | 18/03/2026 09:44 AM (7 महीनों पहले) |
|---|
| संयम | 04/04/2026 08:41 AM (17 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 355289 [FedML-AI FedML तक 0.8.9 gRPC server grpc_server.py sendMessage अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|